summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorBen Skeggs <darktama@iinet.net.au>2006-11-18 10:03:45 +1100
committerBen Skeggs <darktama@iinet.net.au>2006-11-18 10:03:45 +1100
commite9194dd1b068666dd94e73d95dc3cd031a89a6b7 (patch)
tree83731d811d67ffc7a3020ccc5234a951ba0f4b52
parent18bba3fa29187bb5122ed057989203dc05bc46aa (diff)
Check some return vals, fixes a couple of oopses.
-rw-r--r--shared-core/nouveau_fifo.c4
-rw-r--r--shared-core/nouveau_object.c4
2 files changed, 8 insertions, 0 deletions
diff --git a/shared-core/nouveau_fifo.c b/shared-core/nouveau_fifo.c
index 73c4e9f9..441bde40 100644
--- a/shared-core/nouveau_fifo.c
+++ b/shared-core/nouveau_fifo.c
@@ -403,6 +403,10 @@ static int nouveau_fifo_alloc(drm_device_t* dev,drm_nouveau_fifo_alloc_t* init,
NV_DMA_ACCESS_RO,
NV_DMA_TARGET_VIDMEM);
}
+ if (!cb_obj) {
+ DRM_ERROR("unable to alloc object for command buffer\n");
+ return DRM_ERR(EINVAL);
+ }
dev_priv->fifos[i].cmdbuf_obj = cb_obj;
/* that fifo is used */
diff --git a/shared-core/nouveau_object.c b/shared-core/nouveau_object.c
index abd8bec5..0db92ec4 100644
--- a/shared-core/nouveau_object.c
+++ b/shared-core/nouveau_object.c
@@ -523,6 +523,8 @@ int nouveau_ioctl_object_init(DRM_IOCTL_ARGS)
int fifo;
fifo = nouveau_fifo_id_get(dev, filp);
+ if (fifo == -1)
+ return DRM_ERR(EINVAL);
DRM_COPY_FROM_USER_IOCTL(init, (drm_nouveau_object_init_t __user *)
data, sizeof(init));
@@ -577,6 +579,8 @@ int nouveau_ioctl_dma_object_init(DRM_IOCTL_ARGS)
int fifo;
fifo = nouveau_fifo_id_get(dev, filp);
+ if (fifo == -1)
+ return DRM_ERR(EINVAL);
DRM_COPY_FROM_USER_IOCTL(init, (drm_nouveau_dma_object_init_t __user *)
data, sizeof(init));